Tag: incident response
WordPress 7.1.3: Pending Spam Comments Could Carry XSS
WordPress 7.1.3 fixes 7 flaws, including a stored XSS on the Comments screen exploitable via pending comments. Update now and…
Gravity Forms CVE-2026-84434: Check Hidden Upload Fields
Gravity Forms 3.1.0.4 and older let anyone upload files through a hidden File Upload field (CVE-2026-84434, CVSS 9.8). Update to…
Visual Composer CVE-2026-12227: Are You on 45.16.1+?
Visual Composer 45.16.0 and older let unauthenticated attackers run files on your server (CVE-2026-12227). The fix shipped quietly in July.…
Elementor CVE-2026-62062: One Link Can Add an Admin
Elementor 4.3.0 and 4.3.1 let one clicked link create an admin account (CVE-2026-62062). Update to 4.3.2 and check for admins…
cPanel CVE-2026-87899: What WordPress Hosts Should Check
CVE-2026-87899 lets any cPanel login run code as root. Update cPanel to a fixed build, update WP Toolkit to 6.11.3…
Comment2Shell: Check WordPress Comments for CVE-2026-93485
Comment2Shell (CVE-2026-93485) lets an anonymous comment run script in an admin’s browser. Update to WordPress 7.1.1+, then sweep stored comments.
WordPress 7.1.2: Check for CVE-2026-87902 Now
WordPress 7.1.2 fixes CVE-2026-87902, an unauthenticated flaw attackers began probing within hours. Update, then check your theme, PHP settings, and…
Fake Cloudflare CAPTCHA on WordPress (ClickFix)
Seeing a Cloudflare “Verify you are human” page asking users to copy/paste commands? It’s likely fake. Here’s how to fix…
